Sell dataRequest data

Installing the at-source agent

Run Quarry's de-identification inside your environment, as a container or an on-prem agent.

Updated 15 Oct 2026

The agent runs on your hardware, next to the archive. Quarry never holds raw data.

The agent is Quarry's de-identification pipeline, packaged to run inside your environment. It reads your archive in place, writes de-identified output, and sends only that output and a hash log out.

Requirements

  • A Linux host or a Kubernetes cluster that can reach your archive.
  • Read access to the source data (a mount, a bucket, or your PACS export folder).
  • A writable staging area for de-identified output.
  • Outbound HTTPS to Quarry. No inbound ports.
  • GPU is optional; it speeds up transcription for large audio archives.

Install with a container

docker run -d --name quarry-agent \
  -v /mnt/archive:/source:ro \
  -v /mnt/quarry-staging:/staging \
  -e QUARRY_AGENT_TOKEN=<issued at onboarding> \
  <image issued at onboarding>

The source is mounted read-only. The agent can't change or delete anything in your archive.

Run, review, sign off

  1. The agent processes a first batch and prepares a sample.
  2. You and Quarry review the de-identified sample.
  3. When you approve, the agent exports the batch and its hash log.
  4. Later batches follow the same configuration; you can pause or stop the agent at any time.

Updates

New pipeline versions are announced in the changelog. You choose when to update; the version that processed each record is in its manifest.

Removing it

Stop and remove the container, and delete the staging area. Nothing else was installed.